CVE-2017-20256: Joomla Survey Force Deluxe 3.2.4 SQL Injection via invite Parameter
Joomla Survey Force Deluxe 3.2.4 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the invite parameter. Attackers can send GET requests to the component with crafted SQL payloads in the invite parameter to extract sensitive database information.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
joomla/survey-force-deluxefrom your environment.Uninstall or disable the Survey Force Deluxe component (version 3.2.4) from the Joomla installation if it is not required, as this version contains an SQL injection vulnerability in the 'invite' parameter.
- Compensating control
Deploy a WAF rule or web server filter to block or sanitize requests that include the 'invite' parameter for the Survey Force Deluxe component, or restrict access to the component's entry points to trusted IP ranges until a vendor fix is available.
- Operational
Review web and database logs for suspicious GET requests using the 'invite' parameter and any signs of data exfiltration. If sensitive database information may have been exposed, rotate database credentials and any potentially compromised secrets.
Event History
Frequently Asked Questions
What is the severity of CVE-2017-20256?
The severity of CVE-2017-20256 is rated high with a score of 8.2.
How do I fix CVE-2017-20256?
To fix CVE-2017-20256, upgrade Joomla Survey Force Deluxe to the latest version that addresses this SQL injection vulnerability.
What type of vulnerability is CVE-2017-20256?
CVE-2017-20256 is an SQL injection vulnerability affecting Joomla Survey Force Deluxe.
Who is affected by CVE-2017-20256?
Unauthenticated attackers can exploit CVE-2017-20256 to execute arbitrary SQL queries.
What components are involved in CVE-2017-20256?
CVE-2017-20256 involves the invite parameter in the Joomla Survey Force Deluxe 3.2.4 component.